This page was written with AI assistance.

Open source government projects generally do not die from a lack of code. They die from governance. And the part that genuinely puzzles me: they die while everyone involved is doing their honest best.

I have spent twenty years in and around Dutch government IT, and I have sat across from more steering groups than I care to count. The people in them were almost without exception capable and well-intentioned. Still, in all those years I never saw a steering group make a project faster. Slower, yes. That is what a steering group is for: it absorbs risk by adding process, and sometimes that is exactly what an organisation needs. In a technical community that runs on volunteer energy, it drains the very thing the community runs on. It kills the spark.

You know the two-wolves meme. Inside every governmental open source project live two wolves. One writes code. The other writes policy. Neither wolf is wrong, and they wound each other all the same.

The code wolf is a hacker at heart. It wants to ship this week, it improvises, it builds the cool thing at two in the morning because the idea would not let go. Its culture is craft and trust among peers; its stakes are personal: reputation, and the joy of the work itself. Everything you love about open source came out of this wolf's fire, and fire is by nature unpredictable. There is no innovation without risk. Jeff Bezos put it in his 2015 shareholder letter as "failure and invention are inseparable twins", and the numbers agree: Harvard's Shikhar Ghosh followed more than 2,000 venture-backed companies and found that three out of four never return their investors' money. That is what healthy innovation looks like from the outside. Mostly failure, occasionally magic.

The policy wolf did not choose to be dull, and it does not want to be. Its stakes are simply different: public money, political accountability, and a press with a fixed preference, because no wolf has ever made the media for a project well done, while a failed one is front-page news. So the policy wolf learns to prize predictability. It wants to be able to explain, eighteen months from now, why nothing that went wrong came as a surprise. Within its own walls, that is wisdom.

Put them in one room and they hurt each other without meaning to. The code wolf's improvisation gives the policy wolf a heart attack, because on paper, unplanned brilliance is indistinguishable from unmanaged risk. And the policy wolf's predictability smothers the code wolf's fire, because a culture where three out of four attempts are not allowed to fail is a culture where nothing new gets attempted. The whole art of public open source is getting these two to work together, and hardly anyone manages it. The interesting question is why.

Ten months, two signatures, one applicant

On 8 August the Nixpkgs Core Team announced it was disbanding, roughly ten months after it was formed. Nobody phoned this in. The two remaining members wrote that the role had "not turned out to be the lightweight role compatible with active technical contribution that we had originally hoped", and that stepping down was "necessary for our health". Two volunteers who cared about the project walked off the field because staying was hurting them. A public call for new members produced exactly one applicant.

The other side was not a villain either. The team wrote that the Steering Committee "lacks a native instinct for the delegation envisioned by the constitution"; committee member John Ericson pushed back, calling the micromanagement claim "objectively false" and pointing out that the Core Team had barely appeared on the committee's agenda. I believe both of them, and that is the point. A project with a written constitution, elected bodies and formally delegated mandates produced two groups of sincere, capable people who cannot even agree on whether interference took place. When governance works, that debate does not exist.

The people inside say it plainly. Former release manager Jon Ringer: "FOSS nerds don't make good politicians… Nix governance was set up to fail." A sitting Steering Committee member, @cafkafk: "NixOS is such a correct and strong idea that it will survive our absolutely dysfunctional governance. The institution is fine. The people just fail it." Blame the org chart or blame the humans, the conclusion is the same: a governance layer that needs better humans than the ones it actually has is a failed design. And Nix had already tried the more-structure route. The 2024 crises, the "Save Nix Together" letter, Eelco Dolstra stepping away, the moderation resignations: each crisis was answered with new structure, and each structure fed the next crisis. Four days before the disbandment, Domen Kožar gave the whole cycle its test: "The test of governance is not whether it gives me what I want. It is whether I would accept the same rules if the people and positions were reversed."

The hopeful part: Nixpkgs itself is fine. The packages still get reviewed, the build farm still runs, and thousands of contributors shipped right through the drama. The code wolf is perfectly healthy. It just lost its companion again.

Europe has run this experiment before

Battlestar Galactica had a liturgy for it: all of this has happened before, and all of this will happen again. Europe keeps launching sovereign infrastructure vehicles, and as one observer on X noted while listing them, from Theseus through Bull and the European Processor Initiative to Gaia-X, there is "surprisingly little public conversation on the past failure modes".

Gaia-X was built by believers. Its former CEO Francesco Bonfiglio said it himself: "I joined Gaia-X because I believed in the original mission. I left Gaia-X because I didn't believe it was going in the original direction." Announced in 2019 with sincere Franco-German backing, it grew past 320 members, admitted Microsoft, Google, Amazon, Huawei, Alibaba and Palantir as full members, and within sixteen months Politico had a dozen insiders describing infighting and postponed deadlines. Frank Karlitschek of Nextcloud put it mildly: "There's too many cooks in the kitchen." Bonfiglio ended up describing his own job as "the CEO of a consensus-based organization where consensus couldn't be achieved most of the time". Seven years in, Gaia-X has built no data centre and sells no cloud service; it produces labels, frameworks and what Bert Hubert called "standards for talking about standards". No villains required. Give sincere people a consensus structure with 320 conflicting interests, and consensus is what they will spend their years producing instead of software.

I joined Gaia-X because I believed in the original mission. I left Gaia-X because I didn't believe it was going in the original direction.

Francesco Bonfiglio, former CEO, Gaia-X

The pattern is not even specifically European. 18F spent eleven years proving the US government can ship open source that works, Login.gov and IRS Direct File included, and was erased in one political risk calculation in March 2025. The Document Foundation, sincerely worried about conflicts of interest, expelled the developers behind roughly eighty percent of LibreOffice's commits, and the industry responded by starting a fork. Good intentions everywhere, and each time the players end up leaving the field.

Why this matters

Nix stopped being a hobbyist curiosity a while ago. France's DINUM is building its exit from Windows on NixOS: Sécurix, a hardened configuration built to ANSSI requirements, Bureautix for office work, 250 machines by the end of 2026 and ministry-by-ministry roadmaps after that. Reproducible builds and full operator control are the properties everyone in the Eurostack conversations says they want when the alternative is an opaque cloud subject to foreign law.

So European public money is about to stand on a project whose governance just lost its middle layer. I know the reflex that sentence triggers in a ministry, because it comes from a good place: this project needs help, and help looks like the things a ministry knows. A steering group, a decision process, a risk register, a stakeholder matrix. Gaia-X had all of them. It is a sincere gift, and it is the wrong gift.

The referee on an empty field

Why can the two wolves not simply work together? Because each of them is right, at home. I made this argument earlier this year in an internal advisory for a Dutch public-sector collaboration wrestling with exactly this question. An open community runs bottom-up: the people doing the work get trust and room, and that trust is precisely the source of the quality everyone praises. A government runs on risk control, and that is just as functional: its actions face public and political scrutiny, and its value lies in predictability. Put sharply: a government project is allowed to fail, as long as everyone reported neatly and the right bodies took the decisions. That is how a government delivers the predictability we ask of it. Two cultures, both valid, each load-bearing for the organisation that carries it.

What the two cannot do is share one programme, and it is in neither's interest to ask the other to bend. Try it anyway and you get the worst of both worlds: experts who report instead of build, and administrators accountable for a process they cannot actually steer. One interviewee in that advisory put it in a single line: if you don't have the culture, you can't join. Someone arriving from an accountability culture has the will and the knowledge, and still misses the assumptions underneath. They go looking for a steering group where a pull request is the answer. Money does not close the gap either; I have watched a government rebuild with three times the community's budget sink anyway, because it was welded to the wrong context.

There is an unsettling historical mirror for all of this. In 1944 the OSS, the CIA's predecessor, wrote the Simple Sabotage Field Manual: instructions for ordinary citizens to quietly wreck enemy organisations from the inside. Its recipes: talk as frequently as possible and at great length. Refer all matters to committees, never fewer than five people. Haggle over precise wordings. Refer back to matters decided upon at the last meeting. Multiply the procedures and clearances involved in every instruction. Declassified in 2008, it reads, as Corporate Rebels observed, like the agenda of an average organisation, and it points at the claim hiding under this whole post: bad governance is indistinguishable from sabotage. Not because anyone means harm. The manual's genius was that sabotage should look exactly like conscientious management, and the mirror works the other way around too: conscientious management, applied to the wrong culture, does the saboteur's work for free. And that nobody means harm makes it so much harder to spot. A real saboteur can be caught; there is intent, a trail, somewhere a tell. When the same behaviour comes from sincere people doing defensible things, there is nothing to unmask and no line anyone crossed. Just a project that gets a little slower every quarter, and a room full of people who all, verifiably, did their jobs.

Governance without players is a referee on an empty field. And the sad part of that picture is that everyone in the stadium wants the same match: the officials refining the VAR protocol want a fair game, the referee is in position, the audience is still cheering. But the players slipped away, because the fun went out of the game somewhere between the third committee and the fourth postponed deadline. Every story above ends on that image, and nobody in any of them wanted it.

The uncomfortable observation

No project has ever gone faster because of a steering group. Slowing down is what steering groups are for.

Ruben van der Linde

How both wolves eat

The encouraging news is that the answer does not require anyone to change culture. It requires pairing the cultures instead of merging them.

Fund the people who already do the work, without attaching control rights, because a funding line with a board seat creates the same dual power structure Nix just watched fail. Open procurement to the amateur clubs, the community projects and small vendors that actually have players on the pitch, instead of writing it for clubs with a licensed stadium and a legal department. Accept that rough consensus among active contributors is a legitimate way to decide things, even though no auditor will ever love it. And build your own capacity to consume, package and adapt the software, because that is the part you can run in your own culture, with your own accountability. Sécurix is the living proof: France did not ask for a seat on any Nix board, it took the project as it is and built its hardening on top. The community keeps its trust. The government keeps its predictability. Both wolves eat.

Someone on X compressed the same lesson into four words: "Don't crown. Layer." Every failure above began with a coronation and a press release. Every quiet success, from Sécurix to SURF's 100,000-user Nextcloud rollout, began with a layer.

Most policy ends its life in a drawer, and that is fine; drawers are where policy retires. What must not go into the drawer with it is our open source future: the maintainers who burned out waiting for a mandate, the projects that spent their best years in committee. The people who still care about the technical work are the one asset no structure can produce. Everything worth doing in open source governance starts with protecting them.

Fund the work. Trust the people doing it. Keep the players on the field.

Sources

1. Nixpkgs Core Team. The Nixpkgs Core Team has disbanded. The 8 August 2026 announcement on the NixOS Discourse, signed by the two remaining members, quoting the workload, the burnout and the delegation complaints against the Steering Committee.
2. NixOS Discourse. The SC's role in the disbandment of the Nixpkgs Core Team. The follow-up thread in which Steering Committee member John Ericson calls the micromanagement claim "objectively false".
3. Linuxiac. Nixpkgs Core Team dissolves, leaving governance duties without a direct owner. Press coverage of the dissolution, including the recruitment failure and the fallback to the Steering Committee.
4. Domen Kožar. Nixpkgs has a due process problem. Published four days before the disbandment; argues that power in Nixpkgs operates without written standards, timelines or appeal.
5. LWN. NixOS governance in crisis. The 2024 crisis in overview: the Anduril sponsorship conflict, the open letter and the departures that produced the current formal structures.
6. Save Nix Together. An open letter to the NixOS Foundation. The 2024 community letter demanding governance reform.
7. Eelco Dolstra. Leaving the Foundation, going back to the roots. Nix's original author stepping away from the Foundation board in 2024.
8. It's FOSS. NixOS moderation team resigns in protest of SC interference. One of the moderation resignation waves, with the same interference complaint that later surfaced in the Core Team announcement.
9. The Stack. France's shift from US technology starts with 250 DINUM machines and NixOS. The DINUM migration: Sécurix, Bureautix, 250 machines by end of 2026 and per-ministry roadmaps.
10. cloud-gouv. Sécurix. The public repository of France's hardened NixOS configuration for system administrators, built to ANSSI requirements.
11. NixOS Discourse. DINUM (France) is switching to NixOS. The Nix community's own discussion of the French adoption.
12. Il Sole 24 Ore. Europe's big bet on the cloud remains without a data centre. Seven years of Gaia-X: more than 300 members, hyperscalers admitted, no infrastructure built.
13. Bert Hubert. Gaia-X is an expensive distraction. The technical dismantling: standards for talking about standards, two steps removed from being useful.
14. Politico. Chaos and infighting are killing Europe's grand cloud project. October 2021, sixteen months after the unveiling: a dozen insiders on infighting, the board power struggle over government communications, and an official calling the project "a mess".
15. Politico. Anatomy of a Franco-German tech misfire. The November 2025 post-mortem: Bonfiglio on believing in the mission, and on being the CEO of a consensus organisation without consensus.
16. The Conversation. How 18F transformed government technology, and why its elimination matters. What 18F built in eleven years and what was lost on 1 March 2025.
17. LWN. Digging into drama at The Document Foundation. The June 2025 expulsion of the Collabora and allotropia developers behind roughly eighty percent of LibreOffice's commits.
18. Computerworld. Euro-Office billed as Europe's sovereign alternative to Microsoft Office. The March 2026 launch of Euro-Office by Nextcloud, IONOS, Proton and others: the industry's answer to the office-suite governance crisis.
19. Jeff Bezos. 2015 Letter to Shareholders. "Failure and invention are inseparable twins. To invent you have to experiment, and if you know in advance that it's going to work, it's not an experiment."
20. Harvard Business School. The venture capital secret: 3 out of 4 start-ups fail. Shikhar Ghosh's research across more than 2,000 venture-backed companies: roughly 75 percent never return their investors' money.
21. Office of Strategic Services. Simple Sabotage Field Manual (1944), full text. The declassified original at Project Gutenberg: refer all matters to committees of never fewer than five, haggle over precise wordings, refer back to matters decided upon, multiply procedures and clearances.
22. Corporate Rebels. The CIA field manual. On how the 1944 sabotage instructions read as a description of ordinary modern management.
23. Jon Ringer (X). "Nix governance was set up to fail". The former NixOS release manager's reaction to the Core Team disbandment.
24. @cafkafk (X). "It will survive our absolutely dysfunctional governance". A sitting Steering Committee member on their own institution: the institution is fine, the people fail it.
25. @meghanatweets (X). "Don't crown. Layer.". Project Independence, Gaia-X, Aleph Alpha: three countries, three decades, three failure modes, all started with the press release.
26. @_billiambennett (X). European sovereign infrastructure projects. Lists the vehicles from Theseus and Bull to Gaia-X and the European Processor Initiative, and notes how little public conversation exists about their failure modes.